cyb3rfox/Aurora-Incident-Response

Health v2 · maintenance only

Adoption not part of the score

1078 stars · 130 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A cross-platform Electron desktop application for documenting incident response investigations. It digitizes the SANS FOR508 'Spreadsheet of Doom' to help responders track findings, tasks, lateral movement, and timelines while producing reports.

Use cases

• track findings and tasks during an incident response investigation
• visualize lateral movement paths in a security incident
• build a visual timeline of attacker activity
• generate incident response reports from case notes
• replace spreadsheets for DFIR case management

When to choose

• you are an incident responder managing a DFIR case and need structured documentation
• you want a free, offline desktop tool for tracking investigation findings and timelines
• you want to move beyond ad-hoc spreadsheets for incident documentation

When to avoid

• you need a team-based, server-backed incident management platform with multi-user collaboration
• you need automated evidence collection or SIEM-style alerting rather than manual documentation
• you require a mobile-first solution, as tablet support is not yet available

Facets

application · maturity maintenance

developer-tools documentation security developer-tools windows cross-platform incident-response dfir case-management forensics electron-app linux macos electron

Member repositories

For agents

markdown · JSON · MCP: product_card(name="cyb3rfox/Aurora-Incident-Response")